Stored Cross-Site Scripting Vulnerability in Slim Jetpack Plugin for WordPress

CVE-2026-115498

What is CVE-2026-115498?

The Slim Jetpack plugin for WordPress is susceptible to Stored Cross-Site Scripting attacks due to inadequate validation of user input in the 'g<PAGE_ID>-website (Website contact-field)' parameter. This vulnerability affects all versions up to and including 2.7.0.1. An unauthenticated attacker can exploit this flaw to inject malicious scripts into web pages viewed by other users. The issue arises from insufficient input sanitization and escaping, enabling adversaries to embed harmful payloads in any page containing the [contact-form] shortcode. Although nonce and authentication checks exist, they are only enforced for logged-in users, leaving open avenues for attack from unauthenticated visitors.

References